What’s Vulnerable › Vulnerabilities

CVE-2026-40581: ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-18 · updated 2026-10-26
• Weakness: CWE-352

Description

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.

Affected products

• ChurchCRM CRM: before 7.2.0

References

• https://github.com/ChurchCRM/CRM/commit/39361628613af7682b813f3e62a412559616d674
• https://github.com/ChurchCRM/CRM/pull/8613
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-6qxv-xw9j-77pj

Get alerted when CVE-2026-40581 or the next vulnerability affects your stack